Skip to content

Latest commit

 

History

History
79 lines (57 loc) · 2.5 KB

CERTIFICATES.md

File metadata and controls

79 lines (57 loc) · 2.5 KB

PKI certificates management

TLS certificates in a cluster

NOTE

  1. There are issues encountered for K8s HA clusters when certificates renewal is enabled and applied after kubeadm reset. If you restored control plane VMs from snapshots or used this command and plan to run epicli apply, make sure that renew option is set to false.

  2. By default, kubeadm sets certificates expiration period to 1 year. If the cluster is upgraded, and different expiration period is required, run epicli apply with appropriate configuration.

It's possible to regenerate Kubernetes control plane certificates with Epiphany. To do so, additional configuration should be specified.

kind: configuration/kubernetes-master
title: "Kubernetes Master Config"
name: default
provider: <provider>
specification:
  advanced:
    certificates:
      expiration_days: <int>
      renew: true

Parameters (optional):

  1. expiration_days - days to expire in, default value is 365
  2. renew - whether to renew certificates or not, default value is false

NOTE

Usage of values greater than 24855 for expiration_days is not possible. For more information see discussion about that.

When epicly apply executes, if renew option is set to true, following certificates will be renewed with expiration period defined by expiration_days:

  1. admin.conf
  2. apiserver
  3. apiserver-etcd-client
  4. apiserver-kubelet-client
  5. controller-manager.conf
  6. etcd-healthcheck-client
  7. etcd-peer
  8. etcd-server
  9. front-proxy-client
  10. scheduler.conf

NOTE

kubelet.conf is not renewed because kubelet is configured for automatic certificate renewal. To verify that, navigate to /var/lib/kubelet/ and check config.yaml file, where rotateCertificates setting is true by default.

CA certificates rotation

This part cannot be done by Epiphany. Refer to official Kubernetes documentation to perform this task.

References

  1. Best practices
  2. Certificates management by kubeadm
  3. Kubernetes the hard way
  4. Certificates generation with cfssl